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Abstract — In  this  paper,  a  new  strategy  is  proposed 
to  defend  against  colluding  malicious  nodes  in  a  sensor 
network.  The  new  strategy  is  based  on  a  new  relax¬ 
ation  labeling  algorithm  to  classify  nodes  into  benign 
or  malicious  ones.  Only  reports  from  benign  nodes  can 
then  be  used  to  perform  localization  and  obtain  accurate 
results.  Experimental  results  based  on  simulations  and  field 
experiments  illustrate  the  performance  of  the  algorithm. 

I.  Introduction 

As  the  applications  of  sensor  networks  continue  to 
be  developed,  the  capability  to  precisely  calculate  the 
locations  of  the  objects  of  interest  becomes  increasingly 
important  [1],  [2],  Most  of  the  localization  algorithms 
can  be  categorized  as  either  range-based  or  range-free. 
Range-based  methods  collect  range  reports  from  sensor 
nodes  and  use  them  to  calculate  the  exact  position  of 
the  target;  while  range-free  methods  instead  use  hop 
counts. 

The  secure  localization  issue  has  been  investigated 
only  recently.  Sensor  networks  are  often  deployed 
in  hostile  environment,  hence  vulnerable  to  a  variety 
of  attacks  [3],  [4]  which  will  lower  the  accuracy  of 
localization.  To  defeat  such  attacks,  one  strategy  is  to 
focus  on  the  nodes  before  doing  the  localization  task. 
One  may  concentrate  on  verifying  a  node’s  claim  that  it 
is  located  inside  a  physical  region  [5],  or  authenticating 
the  nodes  and  their  messages  [6] — [8].  Another  strategy 
is  to  try  to  localize  the  events  as  accurately  as  possible 
even  under  attacks.  These  methods  are  based  on  the 
concept  of  majority  and  let  the  majority  of  the  nodes  to 
decide.  For  example,  [9]  uses  medium-square  error  and 
[10]  uses  voting. 

In  this  paper,  we  create  a  new  strategy  against  col¬ 
luding  attacks.  Section  II  will  define  the  problem  and 
explain  what  our  contributions  arc,  and  Section  III  will 


explain  our  proposed  algorithm.  Section  IV  demonstrates 
experimental  result,  and  conclusion  follows  afterwards. 

II.  Goals  and  Assumptions 

A.  Problem  Statement 

Consider  the  case  when  we  have  deployed  a  sensor 
network,  and  all  of  the  node  positions  have  been  known 
and  calibrated.  All  of  the  nodes  are  active  and  listen  to 
the  channel  for  possible  event  occurrences,  and  those 
who  have  detected  the  event  will  report  it.  An  unknown 
number  of  nodes  are  replaced  with  malicious  nodes  by 
the  adversary,  or  some  unknown  number  of  additional 
malicious  nodes  are  introduced  into  the  network.  The 
problem  of  secure  localization  is  to  correctly  identify 
the  location  of  the  event  under  the  influence  of  malicious 
nodes. 

B.  Localization  Model 

We  assume  that  sensor  nodes  only  have  range  capa¬ 
bilities.  Due  to  sensing  range,  only  n  of  the  nodes  have 
detected  the  event.  Each  sensor  node  which  has  detected 
the  event  reports  a  range  (),,  i  =  1, ....  n  from  its  location 
to  the  unknown  event  location.  Denoting  the  location  of 
each  sensor  node  as  ( Xi,yi ),  we  obtain 

(Xi  -xo)2  +  (yi  —  2/o)2  =  i  =  1,2,..., n  (1) 

where  (xo>2/o)  is  the  unknown  location  of  the  event.  To 
localize  the  event  in  the  presence  of  zero-mean  additive 
Gaussian  noise  is  to  minimize  the  following  objective 
function 

n 

argmin  ^  [(x^  -  x0)2  +  {yi  -  yo )2  -  <5*2] 2  (2) 

@0,2/0)  i=i 

In  (1),  if  n  sensor  nodes  reported  the  event,  we  will 
have  n  equations.  If  we  subtract  the  i  =  1  equation  from 
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the  other  equations,  we  obtain  (n  —  1)  equations. 

2 (xi  -  xi)x0  +  2 (yi  -  yi)y0  = 

( xi  -  *i)  +  (yi  -  vi)  +  <*?  -  (3) 

where  i  =  2 Denoting  the  unknown  location  of 
the  event  as  x  =  [  xq  yo  ]  ,  and 


2(x2  -  xi)  2(j/2  -  2/1) 

.  2(xn  -  xi)  2(yn  -  2/1)  . 

r  (®1  -  xi)  +  (s/2  -vi)  + s!  -  1 

l_  (x 

:n  “  xl)  +  (Vn  -  Vl)  +  Si  -  Sn  - 

We  get  the  following  linear  system  of  equations 

Ax  =  B.  (4) 

The  location  of  the  event  can  be  found  by  x  = 
A  XB  [1],  If  n  >  3,  we  can  use  the  minimum-squared- 
error  solution  x  =  [A* A]  A  B  to  estimate  the  event 
location  [1].  Such  localization  method  is  often  referred  to 
as  triangulation,  and  it  is  also  known  in  GPS  localization 
[11]  and  cellular  device  localization  [12].  Note  that 
in  triangulation,  we  need  at  least  3  nodes  which  have 
reported  a  range  to  calculate  the  event  location. 

C.  Problem  Definition 

For  each  of  the  n  nodes  that  have  detected  the  event, 
the  location,  (xj,j/i),  and  range  report  6t  are  known. 
We  denote  a  set  of  3  nodes  as  a  triple.  Since  n  >  3,  we 

haVe  (  3  )  =  (n— 3)!3!  =  t.2-Mn-3)  triPleS‘  F01'  eaCh 
triple,  we  can  readily  obtain  an  estimate  of  the  event 
location,  (xq.  yo),  using  triangulation. 

There  is  an  unknown  number  of  malicious  nodes 
inside  the  network.  Furthermore,  we  assume  that  the 
malicious  nodes  are  colluding  -  i.e.  their  range  reports 
point  to  a  fictitious  event  location.  Within  each  triple,  we 
can  calculate  the  error  terms  of  the  3  nodes  by 

6  =  |5j  -  f(x0  -  Xi)2  +  Wo  -  Vi)2\P'  =  1,2,3  (5) 

The  problem  is  then  to  detect  the  malicious  nodes  in  the 
network  using  all  the  available  information. 

D.  Assumptions 

1)  The  event  is  static:  We  assume  that  the  event 
detected  by  the  sensor  network  is  not  moving. 

2 )  Redundancy  of  the  sensor  measurements:  We  as¬ 
sume  that  when  an  event  occurs,  there  arc  more  than 
enough  (n  >  3)  nodes  which  have  detected  the  event. 


3 )  Malicious  nodes:  We  assume  that  malicious  nodes 
can  successfully  authenticate  with  the  network,  and 
they  also  have  obtained  the  encryption  key  used  by 
existing  nodes.  Hence  malicious  nodes  can  successfully 
communicate  within  the  network,  and  any  effort  to  use 
encryption  or  authentication  to  detect  them  will  be  futile. 

4)  Fictitious  event:  The  fictitious  event  location  has 
to  fall  within  the  sensing  range  of  all  the  active  nodes. 
Otherwise,  the  benign  nodes  can  simply  tell  which  node 
is  lying. 

5)  Centralized  Model:  Since  we  are  using  a  triangu¬ 
lation  scheme,  we  assume  a  centralized  system  in  which 
a  central  processor  will  do  the  triangulation  and  also 
process  security  measures.  Secure  localization  methods 
for  ad  hoc  systems  [13]  are  not  covered  in  this  paper. 

E.  Threat  Analysis 

Current  literature  proposes  methods  that  use  a  majority 
concept  to  deal  with  malicious  nodes  [9],  [10],  When 
the  attackers  arc  not  colluding,  these  techniques  can 
detect  those  attackers  who  are  outliers  to  the  community. 
However,  when  the  attackers  arc  colluding,  we  argue 
that  they  become  a  consistent  group  which  are  harder  to 
detect.  It  gets  even  worse  when  the  colluding  malicious 
nodes  becomes  the  majority.  Hence  our  work  focuses  on 
colluding  malicious  nodes. 

F.  Contributions 

Our  contribution  is  two-fold.  First,  we  extend  the 
relaxation  labeling  algorithm  to  use  higher-order  compat¬ 
ibility  functions  [14]  since  localization  requires  triples. 
Second,  we  solve  the  problem  of  colluding  attacks  in 
secure  localization  in  sensor  networks.  Our  strategy 
is  to  examine  the  different  behaviors  of  each  triple, 
and  exploit  their  inconsistency  using  relaxation  labeling. 
Once  the  malicious  nodes  are  detected,  we  can  use  only 
reports  from  benign  nodes  to  perform  localization. 

III.  A  New  Relaxation  Labeling  Architecture 

Our  motivation  is  that  if  there  is  a  malicious  node  in  a 
triple,  the  report  from  the  malicious  one  will  be  different 
from  the  other  two.  On  the  other  hand,  if  all  three 
nodes  in  a  triple  are  benign  (or  malicious),  the  reports 
will  be  consistent.  An  ideal  algorithm  to  exploit  such 
consistency  concept  is  relaxation  labeling  [14]— [16], 
which  was  proposed  first  in  image  processing.  Suppose 
that  we  arc  analyzing  a  picture,  in  which  we  have 
detected  several  objects.  In  order  to  label  each  object 
unambiguously,  we  can  use  the  relationships  that  exist 
between  these  objects.  However,  in  classic  relaxation 
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labeling,  the  compatibility  function  is  often  defined 
for  two  objects.  In  the  context  of  sensor  networks,  we 
need  to  design  higher-order  compatibility  functions  [14] 
since  we  are  dealing  with  triples. 

We  use  a  label  A  for  each  sensor  node  as  assigning 
it  to  be  malicious  or  benign.  For  example,  if  a  node  has 
label  Ao,  it  is  considered  to  be  malicious,  while  having 
label  Ai  denotes  benign.  For  each  sensor  node,  we  define 
a  confidence  P( A).  The  confidence  of  node  i  having 
label  Xj  is  denoted  as  PfiXj).  The  confidence  P%(\j ) 
has  probability-like  properties: 

0<Pi(A0),Pi(Ai)<l  Pi(A0)  +  Pi(Ai)  =  l.  (6) 


For  each  triple  having  nodes  ( i,j ,  k),  we  may  calculate 
the  respective  error  c,  by  equation  (5).  Hence  we  have  e,., 
ej,  f-k  and  e  =  Cj+ey+c/,.  Each  node  of  the  triple  could  be 
either  benign  or  malicious,  so  we  ought  to  have  23  =  8 
different  compatibility  functions  for  a  triple.  However, 
we  assume  that  the  malicious  nodes  are  colluding,  i.e. 
all  the  malicious  nodes  will  report  that  an  artificial  event 
occurred  at  a  particular'  location  (which  is,  of  course, 
different  from  the  true  event  location).  In  this  regard,  the 
case  where  all  three  nodes  are  benign  is  as  compatible  as 
the  case  where  all  three  nodes  malicious.  Let  us  consider 
the  3-node  benign  case.  Since  all  of  the  3  nodes  are 
benign,  the  total  error  should  be  small.  Hence  for  the 
3-node  benign  case,  we  can  define 


Following  [15],  we  will  iteratively  update  the  confi¬ 
dence  of  node  i  having  label  j  as 


r(i,j,k,  Ai,Ai,Ai)  =  1  - 


2 

1  -f  e— (*i(e— Ti) 


(9) 


Pt( Aj)  [1  + 


D\ 


3  =  0,1  (7) 


where  D\  =  -P/(A j)  [l  +  qj{Xj)]  is  a  normalization 

required  to  ensure  that  PfiXj)  sums  to  1,  and  t  stands 
for  iteration. 


Next  we  define  qj(Xj )  to  be  a  measure  of  how  con¬ 
sistent  the  labeling  of  node  i  as  having  label  A  is  with 
the  labeling  of  the  other  two  nodes: 


«.‘<A)  =  ^££EFAy)E fto'x-).  (8) 

j  k  X'  A" 

where  N  =  (n  —  l)(n  —  2),  n  is  the  number  of  active 
nodes  in  the  network,  j  =  1  k  =  I , ....  n,  j  i, 

k  f  i,  j  fi  k,  and  r(-)  is  a  compatibility  function  to 
be  defined  and  explained  later.  The  power  of  q\(X)  is 
that  it  considers  the  consistency  of  node  i  having  label 
A  with  all  other  nodes  j ,  k.  If  node  i  having  A  is  not 
consistent  with  other  nodes,  qf( A)  will  be  negative, 
hence  driving  Pfi A)  down. 

Therefore,  we  need  to  design  a  compatibility  function 
r(i,j,k,  A,  A',  A")  which  will  be  higher  when  nodes 
i,j,k  having  label  A,  A',  A",  respectively,  is  consistent, 
and  vice  versa.  Specifically,  —1  <  r(-)  <  1.  For 
example,  if  we  have  10  nodes,  and  we  are  examining 
nodes  3,  5  and  7.  If  node  3  is  malicious,  and  nodes  5 
and  7  are  benign,  then  r(3, 5,  7,  Ao,  Ai,  Ai)  should  be 
close  to  1. 


where  Tj  is  a  threshold  on  the  error  term  e.  In  equation 
(9),  e  is  the  total  error  of  the  triple.  The  larger  e  is,  the 
less  likely  that  this  triple  has  all  benign  nodes,  because 
a  large  e  indicates  that  the  nodes  in  the  triple  do  not 
agree  with  each  other.  Note  that  in  equation  (9),  the 
function  of  the  form  1/(1  +  e~a^x~^)  is  generally 
referred  to  as  a  sigmoid  function  [17].  The  advantage 
of  using  a  sigmoid  function  is  that  the  compatibility 
function  will  be  a  smooth  curve,  and  the  output  is 
always  constrained  between  -1  and  1,  which  is  what 
we  want  for  a  compatibility  function.  We  show  some 
examples  of  equation  (9)  in  Figure  1. 


Fig.  1.  Some  example  parameter  settings  of  equation  (9) 


The  compatibility  function  for  the  3-node  malicious 
case  is  identical  to  (9)  since  the  malicious  nodes  are 
assumed  to  be  colluding. 
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Next,  if  there  is  only  one  malicious  node  in  the  triple, 
the  other  two  nodes  must  be  benign.  This  one-node 
malicious  case  is  exactly  the  same  as  the  one-node 
benign  case,  because  in  the  one-node  benign  case,  the 
other  two  malicious  nodes  are  colluding. 

Let  us  look  at  the  one-node  malicious  case  first.  For 
one-node  malicious  case,  the  malicious  node  will  tend 
to  have  a  higher  error.  If  node  i  is  malicious,  then  we 
define  the  compatibility  function  for  one-node  malicious 
(one-node  benign)  case  as 


f  -0.5,  e  >  7i 

r(i,j,  k,  A0,  Ai,  Ai)  =  <  (10) 

^  i+e— «2 (*— 72)  ~  e  —  P 

where  x  =  e,/e:,  the  ratio  of  the  error  by  the  malicious 
node  i  divided  by  the  total  error,  e.  The  x  in  (10) 
measures  the  contribution  of  the  malicious  node  to  the 
total  error,  e.  In  equation  (10),  the  larger  x  is,  the  higher 
r  is.  That  is  to  say,  if  we  find  that  for  a  particular  triple 
( i,j ,  k),  the  error  comes  from  node  i  has  a  significantly 
large  contribution  to  the  total  error  e,  then  we  have  a 
high  confidence  to  claim  that  node  i  is  malicious  and 
nodes  j  and  k  are  benign. 

The  other  1-node  benign/malicious  compatibility  func¬ 
tions  are  defined  in  the  same  manner  as  equation  (10). 
Moreover,  we  lower  the  return  values  in  (10)  to  be 
between  -0.5  and  0.5,  since  empirically  we  find  it  to  be 
more  stable.  We  summarize  all  8  compatibility  functions 
in  Table  I.  Note  that  in  Table  I,  rcy-  =  e^/e,  where 
C  =  The  algorithm  of  relaxation  labeling  is 

summarized  in  Table  II. 


r(i,j,k,  Ao,  Ao,  A0) 

1  —  2/(1  +  e-“l(e-Tl)) 

r(i,j,k,  A0,A0,  Ai) 

-0.5  if  e  >  Ti 

1/(1 +  e"“2(a:fc"T2))- 0.5  if  e  <  Ti 

r(i,j,k,  A0,Ai,  A0) 

-0.5  if  e  >  Ti 

1/(1  +  e~“2(a:->“T2))  -0.5  if  e  <  Ti 

r(i,j,k,  Ao,  Ai,  Ai) 

-0.5  if  e  >  Ti 

1/(1  +  e-“2(*i-'r2))  _  0.5  if  e  <  Ti 

r(i,j,k,  Ai,  Ao,  Ao) 

-0.5  if  e  >  Ti 

1/(1 +  e"“2(a!i“T2))- 0.5  if  e  <  Ti 

r(i,j,k,  Ai,  Ao,  Ai) 

-0.5  if  e  >  Ti 

1/(1  +  e““2(aT"T2))  -0.5  if  e  <  Ti 

r(i,j,k,  Ai,Ai,  Ao) 

-0.5  if  e  >  Ti 

1/(1  +  e-a2(xk-T2))  -  0.5  if  e  <  Ti 

r(i,j,k,  Ai,Ai,  Ai) 

l-2/(l  +  e““l(e_Tl)) 

TABLE  I 


Compatibility  Functions 


Use  range  estimates  5i  to  calculate  ti,  tj ,  tk  for  all  triples; 
Initialize  Pi(Xo)  ~  Pi{ Ai)  ~  0.5; 

Set  k  to  be  a  small  positive  number; 
while  (for  all  nodes  (  k  <  Pi(Xo)  <  1  —  k)  { 
for  each  node  { 

Calculate  qi(Xo)  and  c/i ( A i )  using  (8); 

Calculate  IA(Ao)  =  ( Ao ) ( 1  +  ( Ao ) )  +  P;(Ai)(l  +  qt( At)); 

Calculate  Pi(Xo)  =  P(Ao)  x  (1  +  ?i(Ao))/A; 

Calcualte  p(Ai)  =  1  —  P»( Ao); 

11 _ 

TABLE  II 

Algorithm  for  Relaxation  Labeling 


IV.  Experimental  Results 

We  randomly  generate  the  positions  of  n  nodes  in  a 
test  field  of  [0,10]  x  [0,10].  Among  the  n  nodes,  n\ 
are  malicious.  We  simulate  the  sensor  measurements  Zi 
using  the  sensor  model  [1] 

a 

Zi  =  -o  +  Wi,  (11) 

di 

where  a  is  the  amplitude  of  the  event,  ri?;  is  the  distance 
from  sensor  i  to  the  event,  and  w  is  additive  Gaussian 
noise.  We  set  a  =  1.0,  and  equation  (12)  becomes 

zi  =  -pi  +Wi  (12) 

For  benign  nodes,  di  is  the  distance  from  node  i  to 
[x},,  yb),  the  location  of  the  true  event.  Similarly,  for  ma¬ 
licious  nodes,  di  is  the  distance  from  node  i  to  (xrn .  ym), 
the  artificial  event  location  that  the  malicious  nodes 
report.  In  our  simulations,  we  remove  any  randomly- 
placed  nodes  that  happen  to  be  located  equidistantly  to 
( Xb,Ub )  and  ( xrn ,  yrn ) ,  because  the  range  reported  by 
such  nodes  is  ambiguous  and  independent  of  whether 
they  are  assigned  to  malicious  or  benign.  Note  that  in 
(12),  di  is  in  the  order  of  0  to  10,  so  1/d?  is  in  the  order 
of  0  to  0.01.  Hence  in  our  simulations,  noise  variance 
<72  =  0.01  is  considered  to  be  rather  large.  To  obtain 
range  estimates  from  each  sensor  node,  we  calculate 

Si  =  ^m\[j (13) 

In  our  first  experiment,  we  set  ( Xb ,  yi,)  =  (3.0,  3.0) 
and  ( xm,ym )  =  (7.0,  7.0).  All  of  the  probabilities  are 
initialized  at  Pi(\j)  —  0.5.  The  number  of  nodes,  n, 
is  7,  and  the  first  two  nodes  are  always  chosen  to  be 
malicious,  i.e.  ni  =  2.  The  parameters  arc  determined 
experimentally  as  a\  =  4.0,  7\  =  0.1,  a 2  =  2.0, 
T2  =  1/3.  Note  that  a\  and  a. 2  merely  control  the 


This  full  text  paper  was  peer  reviewed  at  the  direction  of  IEEE  Communications  Society  subject  matter  experts  for  publication  in  the  ICC  2007 proceedings. 


slope  of  the  sigmoid  function  in  Equation  (9)  and  (10), 
and  small  changes  of  a±  and  generally  do  not  have 
any  influence  on  the  simulation  outcome.  T2  is  also 
almost  always  set  to  1/3,  hence  the  two  parameters  that 
impact  the  performance  are  T\  and  the  noise  variance  a2. 

To  verify  the  correctness  of  our  relaxation  labeling 
algorithm,  we  set  a2  =  0.000001,  essentially  noise  free. 
The  relaxation  labeling  process  took  22  iterations  to 
converge,  and  the  time  it  took  was  less  than  1  second 
on  a  1.8GHz  PowerMac  G5.  We  plot  the  (random) 
locations  of  the  7  nodes  in  Figure  2.  Also,  based  on  5 
reported  from  each  sensor,  we  plot  a  circle  for  each  node 
in  Figure  2.  In  Figure  3,  we  show  the  convergence  of 
Pi( Ai),  i  =  1, 7.  Since  Pq ( A 1 )  and  Pi(Ai)  converged 
to  0,  node  0  and  node  1  are  found  to  be  malicious. 


Fig.  2.  Simulation  Example  of  7  nodes.  Two  of  the  nodes  are 
malicious. 


Fig.  3.  Convergence  of  P(Xi) 


Next,  to  examine  if  the  relaxation  labeling  process 
is  correct,  we  repeat  the  same  experiment  using 


a2  =  0.000001  and  T\  =  0.01  for  10,000  times,  each 
with  a  different  set  of  (random)  node  locations.  The 
results  of  detect  malicious  nodes  are  all  correct. 

Next,  we  look  at  the  impact  of  parameters  on  the 
system  performance.  Again  we  choose  2  nodes  out  of 
7  nodes  to  be  malicious,  and  we  repeat  the  experiment 
for  100  times.  Each  time  the  random  locations  of  the 
7  nodes  are  different,  but  the  parameters,  T\  and  a2, 
are  the  same.  For  any  experiment  out  of  100  times,  we 
will  consider  an  experiment  a  failure  if  ANY  one  of  the 
7  nodes  is  misclassified.  Note  that  this  is  a  very  strict 
failure  definition.  We  then  perform  another  100-times 
experiment  at  different  T\  and  noise  variance  a2  values. 
The  failure  rate  (out  of  100  experiment)  is  shown  in 
Figure  4  as  a  3D  graph.  Note  that  in  Figure  4,  the  y-axis 
is  log-scale,  hence  noise  variance  a2  ranges  from  1.0  to 
0.000001.  We  can  see  that  at  0.00001  <  cr2  <  0.000001 
and  0.1  <  T]  <  0.75,  the  error  rates  are  almost  0.  The 
error  percentage  goes  up  as  T\  goes  up.  The  optimal 
choice  of  T\  is  within  the  range  of  [0.1,0.75].  As  cr2 
goes  up,  the  failure  rate  goes  up  considerably.  The 
number  of  iterations  required  to  reach  convergence 
corresponding  to  the  T\  and  a2  values  in  Figure  4  arc 
illustrated  in  Figure  5.  In  Figure  4,  the  average  time  to 
perform  any  100-times  experiment  is  3.489  seconds. 


2  -15  0 

log(<P)  T, 


Fig.  4.  The  effect  of  Ti  and  a2  on  the  system  performance 

Finally,  we  fix  the  number  of  malicious  nodes  at  2, 
and  increase  the  number  of  total  nodes  in  the  network. 
We  also  fix  T\  =0.5  and  repeat  the  experiments  for  100 
times,  each  time  with  different  random  node  locations. 
The  failure  rate  (out  of  100  times)  is  shown  in  Figure 
6(a)  at  three  different  noise  levels.  In  Figure  6(a),  we 
can  see  that  the  failure  rate  goes  down  as  the  number  of 
nodes  gradually  increases.  We  also  examine  the  effect  of 
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Fig.  5.  The  number  of  iterations  required  to  reach  convergence 
corresponding  to  the  Ti  and  a2  values  in  Figure  4 

the  number  of  malicious  nodes  on  a  network  in  Figure 
6(b).  In  Figure  6(b),  we  have  20  nodes  in  the  network, 
and  the  number  of  malicious  nodes  goes  from  1  to  19, 
while  T\  =  0.5.  Again,  we  repeat  the  experiments  at 
three  different  noise  levels.  We  can  see  from  Figure 
6(b)  that  at  noise  variance  a2  =  0.0002,  the  system  can 
successfully  detect  malicious  nodes,  even  with  a  high 
number  of  malicious  nodes  in  the  network.  Of  course, 
as  noise  variance  a2  increases,  the  system  performance 
goes  down.  Interestingly,  our  algorithm  seems  to  work 
the  best  when  there  are  about  equal  numbers  of  benign 
and  malicious  nodes. 


(a)  (b) 


Fig.  6.  (a)  Failure  rate  for  a  network  of  various  number  of  nodes. 

At  each  network  size,  only  2  nodes  are  malicious,  (b)  Failure  rate 
for  various  number  of  malicious  nodes  in  a  network  of  20  nodes. 


V.  Conclusions 

We  propose  a  new  relaxation  labeling  architecture 
which  uses  higher-order  compatibility  functions.  Our 
relaxation  labeling  algorithm  can  detect  colluding  ma¬ 
licious  nodes  in  the  sensor  network.  There  are  two 
parameters  affecting  the  performance  of  our  algorithm: 
the  error  threshold  T\  and  noise  variances.  With  suitable 


choice  of  parameters,  our  algorithm  can  detect  a  high 

number  of  malicious  nodes  in  the  network. 
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